In today's world of technology, it is common for applications to execute on more than one computer. For example, one procedure for a software application may call a procedure on another computer, such as over the Internet or other network. Such software applications that execute on more than one computer are called distributed systems. Many distributed systems write diagnostic data to an output stream in order to make them easier to debug. However, these output streams are not always shared by each component of the distributed system. For this reason, data streams sometimes must be merged in order for the event execution to be analyzed in the proper order. One reason data streams must sometimes be merged is to illustrate when the flow of operation left one component and entered another. The act of matching the flow of operation is often called “event correlation”.
Some distributed systems perform event correlation based upon time. Time-based correlation can be problematic because of clock synchronization issues. In other words, it is not always easy or possible to determine how the time on one computer translates into the time on another computer so that events from both machines can be temporally ordered. Another approach to correlation that has been used involves the placement of certain logging details into all of the calls between components to log various details that can be analyzed to re-construct the order of events. Such logging requires modification to existing components in order to support the correlation.